@pellux/goodvibes-sdk 0.28.22 → 0.30.1

package/dist/platform/runtime/permissions/lint.js

@@ -1 +1,72 @@
-export * from '../../../_internal/platform/runtime/permissions/lint.js';
+function toArray(value) {
+    return Array.isArray(value) ? value : [value];
+}
+function isBroadPathPattern(pattern) {
+    return pattern === '**' || pattern === '/' || pattern === '/*' || pattern === '/**';
+}
+function isBroadHostPattern(pattern) {
+    return pattern === '*' || pattern === '*.*' || pattern === '*.com' || pattern === '*:*';
+}
+function lintRule(rule) {
+    const findings = [];
+    if (rule.type === 'path-scope') {
+        if (rule.pathPatterns.some(isBroadPathPattern)) {
+            findings.push({
+                severity: rule.effect === 'allow' ? 'error' : 'warn',
+                ruleId: rule.id,
+                message: `Path scope rule '${rule.id}' uses an overly broad path pattern.`,
+            });
+        }
+    }
+    if (rule.type === 'network-scope') {
+        if (rule.hostPatterns.some(isBroadHostPattern)) {
+            findings.push({
+                severity: rule.effect === 'allow' ? 'error' : 'warn',
+                ruleId: rule.id,
+                message: `Network scope rule '${rule.id}' uses an overly broad host pattern.`,
+            });
+        }
+    }
+    if (rule.type === 'mode-constraint') {
+        if (rule.activeModes.includes('allow-all') && rule.effect === 'allow') {
+            findings.push({
+                severity: 'warn',
+                ruleId: rule.id,
+                message: `Mode constraint rule '${rule.id}' redundantly allows actions in allow-all mode.`,
+            });
+        }
+    }
+    if (rule.type === 'prefix' && rule.effect === 'allow' && toArray(rule.toolPattern).includes('*') && !rule.commandPrefixes?.length) {
+        findings.push({
+            severity: 'error',
+            ruleId: rule.id,
+            message: `Prefix rule '${rule.id}' allows every tool without a command prefix constraint.`,
+        });
+    }
+    return findings;
+}
+export function lintPolicyConfig(config) {
+    const findings = [];
+    const rules = config.rules ?? [];
+    const seenIds = new Set();
+    for (const rule of rules) {
+        if (seenIds.has(rule.id)) {
+            findings.push({
+                severity: 'error',
+                ruleId: rule.id,
+                message: `Duplicate policy rule id '${rule.id}'.`,
+            });
+        }
+        else {
+            seenIds.add(rule.id);
+        }
+        findings.push(...lintRule(rule));
+    }
+    if (config.mode === 'allow-all' && rules.length > 0) {
+        findings.push({
+            severity: 'warn',
+            message: 'Policy rules are loaded while allow-all mode is active; runtime evaluation will still short-circuit to allow-all.',
+        });
+    }
+    return findings;
+}

package/dist/platform/runtime/permissions/normalization/ast.d.ts

@@ -1,2 +1,93 @@
-export * from '../../../../_internal/platform/runtime/permissions/normalization/ast.js';
+/**
+ * Shell AST types for compound command parsing.
+ *
+ * Represents the structural tree of a compound shell command after parsing.
+ * The tree preserves operator relationships between segments so that per-segment
+ * policy evaluation has full structural context.
+ *
+ * Node hierarchy:
+ *   ShellNode = CommandNode | PipeNode | SequenceNode | SubshellNode
+ *
+ * @module normalization/ast
+ */
+import type { CommandToken } from './types.js';
+/**
+ * A leaf node: a single simple command with its parsed tokens.
+ */
+export interface CommandNode {
+    /** Discriminant. */
+    kind: 'command';
+    /** The raw source substring for this command. */
+    raw: string;
+    /** Ordered tokens belonging to this command. */
+    tokens: CommandToken[];
+    /** Canonical command name (first token, path-stripped). */
+    command: string;
+    /** Positional arguments. */
+    args: string[];
+    /** Flags and options. */
+    flags: string[];
+    /**
+     * Set when the parser encountered an error and fell back to a flat CommandNode.
+     * Useful for debug-level diagnostics; not set on successful parses.
+     */
+    parseError?: string;
+}
+/**
+ * A pipe expression: left | right.
+ * Both sides may themselves be compound nodes.
+ */
+export interface PipeNode {
+    /** Discriminant. */
+    kind: 'pipe';
+    /** Left-hand side of the pipe. */
+    left: ShellNode;
+    /** Right-hand side of the pipe. */
+    right: ShellNode;
+}
+/**
+ * A sequence expression: left OP right, where OP is &&, || or ;.
+ */
+export interface SequenceNode {
+    /** Discriminant. */
+    kind: 'sequence';
+    /** The operator connecting left and right. */
+    operator: '&&' | '||' | ';';
+    /** Left-hand operand. */
+    left: ShellNode;
+    /** Right-hand operand. */
+    right: ShellNode;
+}
+/**
+ * A subshell expression: $(…) or `…`.
+ * The inner content is stored as a raw string and optionally parsed.
+ */
+export interface SubshellNode {
+    /** Discriminant. */
+    kind: 'subshell';
+    /** Raw subshell expression (including delimiters). */
+    raw: string;
+    /**
+     * Parsed inner tree, if the subshell content could be parsed.
+     * May be undefined for complex or unparseable subshell content.
+     */
+    inner?: ShellNode;
+}
+/** Discriminated union of all shell AST node types. */
+export type ShellNode = CommandNode | PipeNode | SequenceNode | SubshellNode;
+/**
+ * Collects all CommandNode leaves from a ShellNode tree in left-to-right order.
+ *
+ * @param node - The root node to traverse.
+ * @returns Ordered list of CommandNode leaves.
+ */
+export declare function collectCommandNodes(node: ShellNode, acc?: CommandNode[]): CommandNode[];
+/**
+ * Returns the operator chain connecting a node to its siblings, for display
+ * in denial messages.
+ *
+ * @param node - The node to describe.
+ * @returns A human-readable description of the node kind.
+ */
+export declare function describeNode(node: ShellNode): string;
 //# sourceMappingURL=ast.d.ts.map

package/dist/platform/runtime/permissions/normalization/ast.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ast.d.ts","sourceRoot":"","sources":["../../../../../src/platform/runtime/permissions/normalization/ast.ts"],"names":[],"mappings":"AAAA,cAAc,yEAAyE,CAAC"}
+{"version":3,"file":"ast.d.ts","sourceRoot":"","sources":["../../../../../src/platform/runtime/permissions/normalization/ast.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAI/C;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,oBAAoB;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAC;IAChB,4BAA4B;IAC5B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,yBAAyB;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,IAAI,EAAE,SAAS,CAAC;IAChB,mCAAmC;IACnC,KAAK,EAAE,SAAS,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,oBAAoB;IACpB,IAAI,EAAE,UAAU,CAAC;IACjB,8CAA8C;IAC9C,QAAQ,EAAE,IAAI,GAAG,IAAI,GAAG,GAAG,CAAC;IAC5B,yBAAyB;IACzB,IAAI,EAAE,SAAS,CAAC;IAChB,0BAA0B;IAC1B,KAAK,EAAE,SAAS,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,oBAAoB;IACpB,IAAI,EAAE,UAAU,CAAC;IACjB,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED,uDAAuD;AACvD,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,YAAY,GAAG,YAAY,CAAC;AAI7E;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,GAAE,WAAW,EAAO,GAAG,WAAW,EAAE,CAiB3F;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAOpD"}

package/dist/platform/runtime/permissions/normalization/ast.js

@@ -1 +1,53 @@
-export * from '../../../../_internal/platform/runtime/permissions/normalization/ast.js';
+/**
+ * Shell AST types for compound command parsing.
+ *
+ * Represents the structural tree of a compound shell command after parsing.
+ * The tree preserves operator relationships between segments so that per-segment
+ * policy evaluation has full structural context.
+ *
+ * Node hierarchy:
+ *   ShellNode = CommandNode | PipeNode | SequenceNode | SubshellNode
+ *
+ * @module normalization/ast
+ */
+// ── AST utilities ──────────────────────────────────────────────────────────────
+/**
+ * Collects all CommandNode leaves from a ShellNode tree in left-to-right order.
+ *
+ * @param node - The root node to traverse.
+ * @returns Ordered list of CommandNode leaves.
+ */
+export function collectCommandNodes(node, acc = []) {
+    switch (node.kind) {
+        case 'command':
+            acc.push(node);
+            return acc;
+        case 'pipe':
+            collectCommandNodes(node.left, acc);
+            collectCommandNodes(node.right, acc);
+            return acc;
+        case 'sequence':
+            collectCommandNodes(node.left, acc);
+            collectCommandNodes(node.right, acc);
+            return acc;
+        case 'subshell':
+            if (node.inner)
+                collectCommandNodes(node.inner, acc);
+            return acc;
+    }
+}
+/**
+ * Returns the operator chain connecting a node to its siblings, for display
+ * in denial messages.
+ *
+ * @param node - The node to describe.
+ * @returns A human-readable description of the node kind.
+ */
+export function describeNode(node) {
+    switch (node.kind) {
+        case 'command': return `command(${node.command})`;
+        case 'pipe': return `pipe(${describeNode(node.left)} | ${describeNode(node.right)})`;
+        case 'sequence': return `sequence(${describeNode(node.left)} ${node.operator} ${describeNode(node.right)})`;
+        case 'subshell': return `subshell(${node.raw})`;
+    }
+}

package/dist/platform/runtime/permissions/normalization/canonicalizer.d.ts

@@ -1,2 +1,15 @@
-export * from '../../../../_internal/platform/runtime/permissions/normalization/canonicalizer.js';
+/** SDK-owned platform module. This implementation is maintained in goodvibes-sdk. */
+/**
+ * Resolves a raw command token to its canonical bare command name.
+ *
+ * Processing order:
+ *  1. Strip quotes.
+ *  2. Strip leading environment variable assignments.
+ *  3. Extract the basename (strip directory path).
+ *  4. Lowercase the result.
+ *
+ * @param raw - The raw command token value.
+ * @returns The canonical command name (e.g. "rm", "git", "npm").
+ */
+export declare function canonicalize(raw: string): string;
 //# sourceMappingURL=canonicalizer.d.ts.map

package/dist/platform/runtime/permissions/normalization/canonicalizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"canonicalizer.d.ts","sourceRoot":"","sources":["../../../../../src/platform/runtime/permissions/normalization/canonicalizer.ts"],"names":[],"mappings":"AAAA,cAAc,mFAAmF,CAAC"}
+{"version":3,"file":"canonicalizer.d.ts","sourceRoot":"","sources":["../../../../../src/platform/runtime/permissions/normalization/canonicalizer.ts"],"names":[],"mappings":"AAAA,qFAAqF;AAkCrF;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAuBhD"}

package/dist/platform/runtime/permissions/normalization/canonicalizer.js

@@ -1 +1,61 @@
-export * from '../../../../_internal/platform/runtime/permissions/normalization/canonicalizer.js';
+/** SDK-owned platform module. This implementation is maintained in goodvibes-sdk. */
+/**
+ * Canonicalizer — resolves raw command tokens to their canonical command names.
+ *
+ * Strips:
+ *  - Absolute and relative path prefixes (e.g. /usr/bin/rm → rm)
+ *  - Environment variable assignments that prefix the command
+ *    (e.g. FOO=bar git → git)
+ *  - Quoted wrappers around the command name
+ *
+ * Returns the lowercase bare command name, or an empty string if the
+ * input cannot be resolved.
+ */
+/** Pattern for an environment variable assignment (KEY=value). */
+const ENV_VAR_PREFIX = /^[A-Z_][A-Z0-9_]*=/i;
+/**
+ * Strips shell quoting (single or double) from a string.
+ *
+ * @param value - The raw token value, potentially quoted.
+ * @returns The unquoted string value.
+ */
+function stripQuotes(value) {
+    if ((value.startsWith('"') && value.endsWith('"')) ||
+        (value.startsWith("'") && value.endsWith("'"))) {
+        return value.slice(1, -1);
+    }
+    return value;
+}
+/**
+ * Resolves a raw command token to its canonical bare command name.
+ *
+ * Processing order:
+ *  1. Strip quotes.
+ *  2. Strip leading environment variable assignments.
+ *  3. Extract the basename (strip directory path).
+ *  4. Lowercase the result.
+ *
+ * @param raw - The raw command token value.
+ * @returns The canonical command name (e.g. "rm", "git", "npm").
+ */
+export function canonicalize(raw) {
+    if (!raw)
+        return '';
+    let value = stripQuotes(raw);
+    // Strip env var prefixes (e.g. "FOO=bar command" — take the last space-separated part)
+    const parts = value.split(/\s+/);
+    // Walk forward past any KEY=value segments
+    let commandPart = parts[0] ?? '';
+    for (const part of parts) {
+        if (!ENV_VAR_PREFIX.test(part)) {
+            commandPart = part;
+            break;
+        }
+    }
+    // Extract basename from path (e.g. /usr/bin/git → git, ./scripts/deploy.sh → deploy.sh)
+    const lastSlash = commandPart.lastIndexOf('/');
+    if (lastSlash !== -1) {
+        commandPart = commandPart.slice(lastSlash + 1);
+    }
+    return commandPart.toLowerCase();
+}

package/dist/platform/runtime/permissions/normalization/classifier.d.ts

@@ -1,2 +1,38 @@
-export * from '../../../../_internal/platform/runtime/permissions/normalization/classifier.js';
+/**
+ * Classifier — assigns a CommandClassification to each command segment
+ * and computes the highest-risk classification for a full command.
+ *
+ * Classification priority (highest → lowest):
+ *   destructive > escalation > network > write > read
+ *
+ * Also detects dangerous shell patterns such as rm -rf, force-push, etc.
+ */
+import type { CommandClassification, CommandSegment, NormalizedCommand } from './types.js';
+/**
+ * Returns the higher-priority classification of two.
+ *
+ * @param a - First classification.
+ * @param b - Second classification.
+ * @returns The classification with higher risk priority.
+ */
+export declare function higherPriority(a: CommandClassification, b: CommandClassification): CommandClassification;
+/**
+ * Classifies a single CommandSegment into a CommandClassification tier.
+ *
+ * For compound tools (git, npm, npx, yarn, pnpm, bun), the first positional
+ * argument (sub-command) determines the sub-classification.
+ *
+ * @param seg - The command segment to classify.
+ * @returns The CommandClassification for this segment.
+ */
+export declare function classifySegment(seg: CommandSegment): CommandClassification;
+/**
+ * Classifies a full normalized command, computing the union of classifications
+ * across all segments and the highest-risk tier.
+ *
+ * @param original - The original command string.
+ * @param segments - The command segments to classify.
+ * @returns A partial NormalizedCommand (without the original field, for composability).
+ */
+export declare function classifyCommand(original: string, segments: CommandSegment[]): Omit<NormalizedCommand, 'original' | 'segments'>;
 //# sourceMappingURL=classifier.d.ts.map

package/dist/platform/runtime/permissions/normalization/classifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"classifier.d.ts","sourceRoot":"","sources":["../../../../../src/platform/runtime/permissions/normalization/classifier.ts"],"names":[],"mappings":"AAAA,cAAc,gFAAgF,CAAC"}
+{"version":3,"file":"classifier.d.ts","sourceRoot":"","sources":["../../../../../src/platform/runtime/permissions/normalization/classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,qBAAqB,EACrB,cAAc,EACd,iBAAiB,EAClB,MAAM,YAAY,CAAC;AAmKpB;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,CAAC,EAAE,qBAAqB,EACxB,CAAC,EAAE,qBAAqB,GACvB,qBAAqB,CAIvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,qBAAqB,CAyE1E;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,cAAc,EAAE,GACzB,IAAI,CAAC,iBAAiB,EAAE,UAAU,GAAG,UAAU,CAAC,CAoClD"}

package/dist/platform/runtime/permissions/normalization/classifier.js

@@ -1 +1,277 @@
-export * from '../../../../_internal/platform/runtime/permissions/normalization/classifier.js';
+/**
+ * Classifier — assigns a CommandClassification to each command segment
+ * and computes the highest-risk classification for a full command.
+ *
+ * Classification priority (highest → lowest):
+ *   destructive > escalation > network > write > read
+ *
+ * Also detects dangerous shell patterns such as rm -rf, force-push, etc.
+ */
+// ── Classification sets ────────────────────────────────────────────────────────
+/** Commands classified as read-only operations. */
+const READ_COMMANDS = new Set([
+    'cat', 'head', 'tail', 'less', 'more', 'bat',
+    'grep', 'egrep', 'fgrep', 'rg', 'ag',
+    'find', 'locate', 'which', 'whereis', 'type',
+    'ls', 'dir', 'tree', 'du', 'df', 'stat', 'file',
+    'wc', 'sort', 'uniq', 'cut',
+    'diff', 'cmp', 'md5sum', 'sha256sum', 'shasum',
+    'ps', 'top', 'htop', 'env', 'printenv', 'pwd', 'id', 'whoami',
+    'date', 'uname', 'uptime',
+]);
+/** Git sub-commands that are read-only. */
+const GIT_READ_SUBCOMMANDS = new Set([
+    'log', 'status', 'diff', 'show', 'branch', 'tag',
+    'describe', 'shortlog', 'reflog', 'blame', 'grep',
+    'ls-files', 'ls-tree', 'rev-parse', 'cat-file',
+]);
+/** Commands classified as write operations. */
+const WRITE_COMMANDS = new Set([
+    'cp', 'mv', 'mkdir', 'touch', 'ln', 'chmod', 'chown', 'chgrp',
+    'tee', 'install',
+    'zip', 'unzip', 'tar', 'gzip', 'gunzip',
+    'patch', 'sed', 'awk',
+]);
+/** Git sub-commands that are write operations. */
+const GIT_WRITE_SUBCOMMANDS = new Set([
+    'add', 'commit', 'merge', 'rebase', 'cherry-pick',
+    'stash', 'apply', 'am', 'checkout', 'switch', 'restore',
+    'init',
+]);
+/** npm / package manager sub-commands that are write operations. */
+const NPM_WRITE_SUBCOMMANDS = new Set(['install', 'i', 'ci', 'update', 'uninstall', 'link', 'pack']);
+/** Commands classified as network operations. */
+const NETWORK_COMMANDS = new Set([
+    'curl', 'wget', 'http', 'httpie', 'nc', 'netcat',
+    'ssh', 'scp', 'sftp', 'rsync',
+    'ftp', 'ftps', 'telnet',
+    'ping', 'traceroute', 'nslookup', 'dig', 'host',
+]);
+/** Git sub-commands that involve network I/O. */
+const GIT_NETWORK_SUBCOMMANDS = new Set(['push', 'fetch', 'pull', 'clone', 'remote']);
+/** npm / package manager sub-commands that involve network I/O. */
+const NPM_NETWORK_SUBCOMMANDS = new Set(['publish', 'deprecate']);
+/** Commands classified as destructive operations. */
+const DESTRUCTIVE_COMMANDS = new Set([
+    'rm', 'rmdir', 'shred', 'wipe', 'wipefs',
+    'mkfs', 'fdisk', 'parted', 'dd',
+    'kill', 'killall', 'pkill',
+    'truncate',
+]);
+/** SQL keywords indicating destructive database operations (used in pattern detection). */
+const DESTRUCTIVE_SQL_PATTERNS = ['DROP ', 'DELETE ', 'TRUNCATE '];
+/** Git sub-commands that are destructive when combined with certain flags. */
+const GIT_DESTRUCTIVE_SUBCOMMANDS = new Set([
+    'reset', 'clean', 'gc', 'prune', 'reflog',
+]);
+/** Commands that escalate privileges. */
+const ESCALATION_COMMANDS = new Set([
+    'sudo', 'su', 'doas', 'pkexec', 'runas',
+    'docker', 'kubectl', 'helm', 'oc',
+    'nsenter', 'unshare', 'chroot',
+    'setuid', 'setgid',
+]);
+const DANGEROUS_PATTERNS = [
+    {
+        description: 'rm -rf: recursive forced deletion',
+        match: (seg) => seg.command === 'rm' &&
+            seg.flags.some((f) => f.includes('r') || f === '-r' || f === '--recursive') &&
+            seg.flags.some((f) => f.includes('f') || f === '-f' || f === '--force'),
+    },
+    {
+        description: 'rm -rf /: attempted root filesystem deletion',
+        match: (seg) => seg.command === 'rm' &&
+            seg.flags.some((f) => f.includes('r')) &&
+            seg.flags.some((f) => f.includes('f')) &&
+            seg.args.some((a) => a === '/' || a === '/*'),
+    },
+    {
+        description: 'git reset --hard: irreversible history rewrite',
+        match: (seg) => seg.command === 'git' &&
+            seg.args[0] === 'reset' &&
+            seg.flags.includes('--hard'),
+    },
+    {
+        description: 'git clean -fd: removes untracked files and directories',
+        match: (seg) => seg.command === 'git' &&
+            seg.args[0] === 'clean' &&
+            seg.flags.some((f) => f.includes('f')),
+    },
+    {
+        description: 'git push --force: force-pushes, may rewrite remote history',
+        match: (seg) => seg.command === 'git' &&
+            seg.args[0] === 'push' &&
+            (seg.flags.includes('--force') || seg.flags.includes('-f')),
+    },
+    {
+        description: 'SQL DROP/DELETE/TRUNCATE: destructive database operation',
+        match: (seg) => DESTRUCTIVE_SQL_PATTERNS.some((pattern) => seg.raw.toUpperCase().includes(pattern)),
+    },
+    {
+        description: 'sudo: command run with elevated privileges',
+        match: (seg) => seg.command === 'sudo',
+    },
+    {
+        description: 'docker exec: executing inside a container',
+        match: (seg) => seg.command === 'docker' && seg.args[0] === 'exec',
+    },
+    {
+        description: 'kubectl exec: executing inside a Kubernetes pod',
+        match: (seg) => seg.command === 'kubectl' && seg.args[0] === 'exec',
+    },
+    {
+        description: 'dd: raw disk write (potentially destructive)',
+        match: (seg) => seg.command === 'dd',
+    },
+];
+// ── Classification priority ────────────────────────────────────────────────────
+/** Ordered priority: index 0 = highest risk. */
+const CLASSIFICATION_PRIORITY = [
+    'destructive',
+    'escalation',
+    'network',
+    'write',
+    'read',
+];
+/**
+ * Returns the higher-priority classification of two.
+ *
+ * @param a - First classification.
+ * @param b - Second classification.
+ * @returns The classification with higher risk priority.
+ */
+export function higherPriority(a, b) {
+    const ai = CLASSIFICATION_PRIORITY.indexOf(a);
+    const bi = CLASSIFICATION_PRIORITY.indexOf(b);
+    return ai <= bi ? a : b;
+}
+/**
+ * Classifies a single CommandSegment into a CommandClassification tier.
+ *
+ * For compound tools (git, npm, npx, yarn, pnpm, bun), the first positional
+ * argument (sub-command) determines the sub-classification.
+ *
+ * @param seg - The command segment to classify.
+ * @returns The CommandClassification for this segment.
+ */
+export function classifySegment(seg) {
+    const { command, args, flags } = seg;
+    // ── Escalation check (highest priority) ─────────────────────────────────────
+    // For sudo/doas/su, unwrap the inner command and take the higher-priority classification.
+    const SUDO_LIKE = new Set(['sudo', 'doas', 'su']);
+    if (SUDO_LIKE.has(command)) {
+        const innerArgs = [...args];
+        if (innerArgs.length > 0) {
+            const innerCommand = innerArgs[0];
+            const innerSeg = {
+                ...seg,
+                command: innerCommand,
+                args: innerArgs.slice(1),
+            };
+            const innerCls = classifySegment(innerSeg);
+            return higherPriority(innerCls, 'escalation');
+        }
+        return 'escalation';
+    }
+    if (ESCALATION_COMMANDS.has(command))
+        return 'escalation';
+    // ── git sub-command routing ─────────────────────────────────────────────────
+    if (command === 'git') {
+        const sub = args[0] ?? '';
+        if (GIT_DESTRUCTIVE_SUBCOMMANDS.has(sub)) {
+            // git reset --hard is always destructive; other git destructive cmds need flags
+            if (sub === 'reset' && flags.includes('--hard'))
+                return 'destructive';
+            if (sub === 'clean')
+                return 'destructive';
+            // git reflog delete etc — treat as destructive
+            if (sub === 'gc' || sub === 'prune')
+                return 'destructive';
+            // fallthrough to write for other cases (e.g. git reflog alone = read)
+            if (sub === 'reflog' && args.length === 1)
+                return 'read';
+        }
+        if (GIT_NETWORK_SUBCOMMANDS.has(sub))
+            return 'network';
+        if (GIT_WRITE_SUBCOMMANDS.has(sub))
+            return 'write';
+        if (GIT_READ_SUBCOMMANDS.has(sub))
+            return 'read';
+        // Unknown git sub-command: treat as write (conservative)
+        return 'write';
+    }
+    // ── npm / npx / yarn / pnpm / bun routing ───────────────────────────────────
+    const isPackageManager = ['npm', 'npx', 'yarn', 'pnpm', 'bun'].includes(command);
+    if (isPackageManager) {
+        const sub = args[0] ?? '';
+        if (NPM_NETWORK_SUBCOMMANDS.has(sub))
+            return 'network';
+        if (NPM_WRITE_SUBCOMMANDS.has(sub))
+            return 'write';
+        // run, exec, x, dlx — treat as write (executes code)
+        if (sub === 'run' || sub === 'exec' || sub === 'x' || sub === 'dlx')
+            return 'write';
+        // info, view, list, ls, audit, outdated — read
+        if (['info', 'view', 'list', 'ls', 'audit', 'outdated'].includes(sub))
+            return 'read';
+        return 'write'; // conservative default
+    }
+    // ── Destructive commands ─────────────────────────────────────────────────────
+    if (DESTRUCTIVE_COMMANDS.has(command))
+        return 'destructive';
+    // ── Network commands ─────────────────────────────────────────────────────────
+    if (NETWORK_COMMANDS.has(command))
+        return 'network';
+    // ── Write commands ───────────────────────────────────────────────────────────
+    if (WRITE_COMMANDS.has(command))
+        return 'write';
+    // ── Read commands ────────────────────────────────────────────────────────────
+    if (READ_COMMANDS.has(command))
+        return 'read';
+    // ── echo/printf: redirect makes it a write, otherwise read ─────────────────────
+    if (command === 'echo' || command === 'printf') {
+        return seg.tokens.some((t) => t.type === 'redirect') ? 'write' : 'read';
+    }
+    // Unknown command: conservative default — write
+    return 'write';
+}
+/**
+ * Classifies a full normalized command, computing the union of classifications
+ * across all segments and the highest-risk tier.
+ *
+ * @param original - The original command string.
+ * @param segments - The command segments to classify.
+ * @returns A partial NormalizedCommand (without the original field, for composability).
+ */
+export function classifyCommand(original, segments) {
+    if (segments.length === 0) {
+        return {
+            classifications: ['read'],
+            highestClassification: 'read',
+            hasDangerousPatterns: false,
+        };
+    }
+    const classificationSet = new Set();
+    let highest = 'read';
+    for (const seg of segments) {
+        const cls = classifySegment(seg);
+        classificationSet.add(cls);
+        highest = higherPriority(highest, cls);
+    }
+    // ── Dangerous pattern detection ──────────────────────────────────────────────
+    const matched = [];
+    for (const seg of segments) {
+        for (const pattern of DANGEROUS_PATTERNS) {
+            if (pattern.match(seg)) {
+                matched.push(pattern.description);
+            }
+        }
+    }
+    const hasDangerousPatterns = matched.length > 0;
+    return {
+        classifications: Array.from(classificationSet),
+        highestClassification: highest,
+        hasDangerousPatterns,
+        ...(hasDangerousPatterns ? { dangerousPatterns: matched } : {}),
+    };
+}

package/dist/platform/runtime/permissions/normalization/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/platform/runtime/permissions/normalization/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EACV,YAAY,EACZ,cAAc,EACd,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,SAAS,EACT,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,YAAY,GACb,MAAM,UAAU,CAAC;AAElB,YAAY,EACV,cAAc,EACd,eAAe,GAChB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAKxH,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAG3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD;;;;;;;;;;;GAWG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,MAAM,EACf,cAAc,GAAE,WAAW,CAAC,qBAAqB,CAA2B,GAC3E,eAAe,CAGjB;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,CAWnE"}